[Contents] [Prev] [Next] [Index] [Report an Error]

Configuring Authentication Plug-Ins

You can perform the following tasks to configure authentication plug-ins:

Limiting Subscribers on Router Interfaces

You can limit the number of authenticated subscribers who connect to an IP interface on the router. This plug-in does not limit the number of unauthenticated subscribers who connect to an IP interface, and does not limit the number of subscribers who connect to a physical or link-layer interface. In the case of subscriber interfaces, the plug-in limits the number of authenticated subscribers on the subscriber interface but not on the underlying primary IP interface.

Use the following configuration statement to set up a plug-in that limits the number of subscribers who connect to interfaces:



shared sae configuration plug-ins name  name  interface-subscriber-limit {
concurrent-subscribers  concurrent-subscribers ; 
}

To set up a plug-in that limits the number of subscribers on interfaces:

From configuration mode, access the custom RADIUS accounting plug-in configuration. In this sample procedure, the plug-in called subsLimit is configured in the west-region SAE group.
Configure the number of authenticated subscribers who can connect to an IP interface on the router simultaneously.

(Optional) Verify your configuration.

[edit shared sae group west-region configuration plug-ins name subsLimit interface-subscriber-limit]
user@host# show 
concurrent-subscribers 1;

Configuring Basic RADIUS Authentication Plug-Ins

You can use basic RADIUS authentication plug-ins to send authentication information to an external RADIUS accounting server or a group of redundant servers. To communicate with nonredundant servers, you need to create additional instances of the plug-in.

Use the following configuration statements to set up basic RADIUS authentication plug-ins:



shared sae configuration plug-ins name  nam e radius-authentication {
load-balancing-mode (failover | roundRobin); 
failback-timer  failback-timer ; 
nas-ip (SspIp | ErxIp); 
retry-interval  retry-interval ; 
maximum-queue-length  maximum-queue-length ; 
bind-address  bind-address ; 
udp-port  udp-port ; 
default-peer  default-peer ; 
}

To set up basic RADIUS authentication plug-ins:

From configuration mode, access the basic RADIUS authentication plug-in configuration. In this sample procedure, the plug-in called RadiusAuth is configured in the west-region SAE group.
Configure the mode for load-balancing RADIUS servers.
Specify if and when the SAE attempts to fail back to the default peer.
(Optional) Configure the value of the NAS-Ip attribute.
Configure the time the SAE waits for a response from a RADIUS server before it resends the RADIUS packet.
Configure the maximum number of unacknowledged RADIUS messages that the plug-in receives from the RADIUS server before it discards new messages.
(Optional) Configure the source IP address that the plug-in uses to communicate with the RADIUS server. If you do not specify an address, the global default address is used.
(Optional) Configure the source UDP port or a range of source UDP ports used for communication with the RADIUS server. If you do not specify a UDP port, the global UDP port is used.
Configure the name of the RADIUS server to which the SAE sends packets for this plug-in.

(Optional) Verify your configuration.

[edit shared sae group west-region configuration plug-ins name RadiusAuth radius-authentication]
user@host# show 
load-balancing-mode failover;
failback-timer -1;
retry-interval 3000;
maximum-queue-length 10000;
default-peer peer1;

Configuring Flexible RADIUS Authentication Plug-Ins

Flexible RADIUS authentication plug-ins provide the same features as basic RADIUS authentication plug-ins. In addition, they allow you to customize RADIUS authentication packets that the system sends to RADIUS servers and specify which fields are included in the RADIUS authentication packets and what information is contained in the fields.

Use the following configuration statements to set up flexible RADIUS authentication plug-ins:



shared sae configuration plug-ins name  name  flex-radius-authentication {
load-balancing-mode (failover | roundRobin); 
failback-timer  failback-timer ; 
timeout  timeout ; 
retry-interval  retry-interval ; 
maximum-queue-length  maximum-queue-length ; 
bind-address  bind-address ; 
udp-port  udp-port ; 
error-handling (0 | 1); 
default-peer  default-peer;  

template  template ; 
}

To set up flexible RADIUS authentication plug-ins:

From configuration mode, access the flexible RADIUS authentication plug-in configuration. In this sample procedure, the plug-in called flexRadiusAuth is configured in the west-region SAE group.
Configure the mode for load-balancing RADIUS servers.
Specify if and when the SAE attempts to fail back to the default peer.
(Optional) Configure the maximum time the SAE waits for a response from a RADIUS server.
Configure the time the SAE waits for a response from a RADIUS server before it resends the RADIUS packet.
Configure the maximum number of unacknowledged RADIUS messages that the plug-in receives from the RADIUS server before it discards new messages.
(Optional) Configure the source IP address that the plug-in uses to communicate with the RADIUS server. If you do not specify an address, the global default address is used.
(Optional) Configure the source UDP port or a range of source UDP ports used for communication with the RADIUS server. If you do not specify a UDP port, the global UDP port is used.
Configure the way the SAE handles errors.
Configure the name of the RADIUS server to which the SAE sends packets for this plug-in.
Configure the name of the RADIUS packet template that defines attributes for this plug-in.

(Optional) Verify your configuration.

[edit shared sae group west-region configuration plug-ins name flexRadiusAuth flex-radius-authentication]
user@host# show 
load-balancing-mode failover;
failback-timer -1;
timeout 15000;
retry-interval 3000;
maximum-queue-length 10000;
error-handling 0;
default-peer 1;
template stdAuth;
peer-group 1 {
  server-address ;
  server-port 1812;
  secret ********;
}

Configuring Custom RADIUS Authentication Plug-Ins

The custom RADIUS authentication plug-ins provide the same functions as the flexible RADIUS authentication plug-ins, but are designed to deliver better system performance. To use a custom plug-in, you must provide a Java class that implements the SPI defined in the RADIUS client library. Use this SPI to specify which fields and field values to include in RADIUS accounting packets. The RADIUS client library is part of the SAE core API.

See the documentation for the RADIUS client library in the SAE core API documentation on the Juniper Networks Web site at



 
http://www.juniper.net/techpubs/software/management/src/api-index.html

For a sample implementation, see in the SDK+AppSupport+Demos+Samples.tar.gz file on the Juniper Networks Web site at: https://www.juniper.net/support/csc/swdist-erx/src.html The application is located the following directory: SDK/plugin/java/src/net/juniper/smgt/sample/radiuslib/RadiusPacketHandlerImpl.java.

Use the following configuration statements to set up custom RADIUS authentication plug-ins:



shared sae configuration plug-ins name  name  custom-radius-authentication {
java-class-radius-packet-handler  java-class-radius-packet-handler ; 
class-path-radius-packet-handler  class-path-radius-packet-handler ; 
require-mandatory-attributes; 
load-balancing-mode (failover | roundRobin); 
failback-timer  failback-timer ; 
timeout  timeout ; 
retry-interval  retry-interval ; 
maximum-queue-length  maximum-queue-length ; 
bind-address  bind-address ; 
udp-port  udp-port ; 
default-peer  default-peer;  

}

To set up custom RADIUS authentication plug-ins:

From configuration mode, access the custom RADIUS authentication plug-in configuration. In this sample procedure, the plug-in called customRadiusAuth is configured in the west-region SAE group.
Configure the name of the Java class that implements the RadiusPacketHandler interface in the RADIUS client library.
Configure the URLs that identify a location from which Java classes are loaded when the plug-in is initialized.
(Optional) Specify that a RADIUS authentication or accounting request must contain all mandatory RADIUS attributes before sending the request packet.
Configure the mode for load-balancing RADIUS servers.
Specify if and when the SAE attempts to fail back to the default peer.
(Optional) Configure the maximum time the SAE waits for a response from a RADIUS server.
Configure the time the SAE waits for a response from a RADIUS server before it resends the RADIUS packet.
Configure the maximum number of unacknowledged RADIUS messages that the plug-in receives from the RADIUS server before it discards new messages.
(Optional) Configure the source IP address that the plug-in uses to communicate with the RADIUS server. If you do not specify an address, the global default address is used.
(Optional) Configure the source UDP port or a range of source UDP ports used for communication with the RADIUS server. If you do not specify a UDP port, the global UDP port is used.
Configure the name of the RADIUS server to which the SAE sends packets for this plug-in.

(Optional) From operational mode, verify your configuration.

[edit shared sae configuration plug-ins name customRadiusAuth custom-radius-authorization]
user@host# show 
java-class-radius-packet-handler net.juniper.smgt.radius.RadiusPacketHandlerImpl;
require-mandatory-attributes;
load-balancing-mode failover;
failback-timer -1;
timeout 15000;
retry-interval 3000;
maximum-queue-length 10000;
default-peer peer4;

Configuring LDAP Authentication Plug-Ins

Use the following configuration statements to configure LDAP authentication plug-ins:



shared sae configuration plug-ins name  name  ldap-authentication {
method (search | bind); 
server  server ; 
bind-dn  bind-dn ; 
bind-password  bind-password ; 
search-filter  search-filter ;
(ldaps); 
search-base-dn  search-base-dn ; 
name-attribute  name-attribute ; 
password-attribute  password-attribute ; 
service-bundle-attribute  service-bundle-attribute ; 
session-volume-quota  session-volume-quota ;
timeout  timeout ; 
}

To create LDAP authentication plug-ins:

From configuration mode, access the custom LDAP authentication plug-in configuration. In this sample procedure, the plug-in called ldapAuth is configured in the west-region SAE group.
Configure the LDAP authentication method that the SAE uses.
(Optional) Configure a comma-separated list of IP addresses or hostnames of the LDAP authentication server.
(Optional) Configure the DN used to authenticate access to the directory.
(Optional) Configure the password that the SAE uses to authenticate its access to the directory to search for the subscriber profile. If you do not specify a bind DN or bind password, the SAE uses anonymous access.
(Optional) Configure the additional LDAP search filter that the SAE uses to search the directory for the subscriber profile.
(Optional) Enable the secure protocol used for LDAP connections with the directory. LDAPS, the only secure protocol supported, causes communication with the directory to be encrypted with Secure Sockets Layer (SSL).
(Optional) Configure the base DN for searching entries in the directory.
(Optional) Configure the name of the directory attribute that holds the username.
(Optional) Configure the name of the directory attribute that stores the password.
(Optional) Configure the name of the directory attribute that contains the name of the service bundle that is used for subscriber authentication. This value is made available to the subscriber classification process and can be used to select the subscriber profile to load.
(Optional) Configure the name of the LDAP attribute that contains the value of the session volume quota. The LDAP plug-in sets the session volume quota to this value.
(Optional) Configure the maximum time the SAE waits for a response from a directory server.

(Optional) From operational mode, verify your configuration.

[edit shared sae group west-region configuration plug-ins name ldapAuth ldap-authentication]
user@host# show 
method search;
search-filter (objectClass=umcSubscriber);
name-attribute uniqueId;
timeout 5000;

[Contents] [Prev] [Next] [Index] [Report an Error]